From 3f0d527375ed90230fb715a93860e6b7c7ca1c9f Mon Sep 17 00:00:00 2001
From: tb <tb@openbsd.org>
Date: Mon, 24 Apr 2023 22:24:39 +0000
Subject: [PATCH] Mark NETSCAPE_CERT_SEQUENCE for removal

discussed with beck and jsing
---
 lib/libcrypto/pem/pem.h     | 4 +++-
 lib/libcrypto/pem/pem_all.c | 4 +++-
 lib/libcrypto/x509/x509.h   | 8 ++++++--
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/libcrypto/pem/pem.h b/lib/libcrypto/pem/pem.h
index a0f7d78c010..092d815c58f 100644
--- a/lib/libcrypto/pem/pem.h
+++ b/lib/libcrypto/pem/pem.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: pem.h,v 1.24 2022/07/12 14:42:50 kn Exp $ */
+/* $OpenBSD: pem.h,v 1.25 2023/04/24 22:24:39 tb Exp $ */
 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -425,7 +425,9 @@ DECLARE_PEM_rw(X509_CRL, X509_CRL)
 
 DECLARE_PEM_rw(PKCS7, PKCS7)
 
+#if !defined(LIBRESSL_NEXT_API) || defined(LIBRESSL_INTERNAL)
 DECLARE_PEM_rw(NETSCAPE_CERT_SEQUENCE, NETSCAPE_CERT_SEQUENCE)
+#endif
 
 DECLARE_PEM_rw(PKCS8, X509_SIG)
 
diff --git a/lib/libcrypto/pem/pem_all.c b/lib/libcrypto/pem/pem_all.c
index f5211f29a67..82c7fc43d36 100644
--- a/lib/libcrypto/pem/pem_all.c
+++ b/lib/libcrypto/pem/pem_all.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pem_all.c,v 1.17 2016/09/04 16:10:38 jsing Exp $ */
+/* $OpenBSD: pem_all.c,v 1.18 2023/04/24 22:24:39 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -239,12 +239,14 @@ PEM_write_bio_PKCS7(BIO *bp, PKCS7 *x)
 	    x, NULL, NULL, 0, NULL, NULL);
 }
 
+#if !defined(LIBRESSL_NEXT_API)
 int
 PEM_write_NETSCAPE_CERT_SEQUENCE(FILE *fp, NETSCAPE_CERT_SEQUENCE *x)
 {
 	return PEM_ASN1_write((i2d_of_void *)i2d_NETSCAPE_CERT_SEQUENCE, PEM_STRING_X509, fp,
 	    x, NULL, NULL, 0, NULL, NULL);
 }
+#endif
 
 NETSCAPE_CERT_SEQUENCE *
 PEM_read_NETSCAPE_CERT_SEQUENCE(FILE *fp, NETSCAPE_CERT_SEQUENCE **x, pem_password_cb *cb, void *u)
diff --git a/lib/libcrypto/x509/x509.h b/lib/libcrypto/x509/x509.h
index ece90288801..bed87d8c7c0 100644
--- a/lib/libcrypto/x509/x509.h
+++ b/lib/libcrypto/x509/x509.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509.h,v 1.98 2023/04/24 08:39:06 job Exp $ */
+/* $OpenBSD: x509.h,v 1.99 2023/04/24 22:24:39 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -334,12 +334,13 @@ typedef struct Netscape_spki_st {
 	ASN1_BIT_STRING *signature;
 } NETSCAPE_SPKI;
 
+#if !defined(LIBRESSL_NEXT_API) || defined(LIBRESSL_INTERNAL)
 /* Netscape certificate sequence structure */
 typedef struct Netscape_certificate_sequence {
 	ASN1_OBJECT *type;
 	STACK_OF(X509) *certs;
 } NETSCAPE_CERT_SEQUENCE;
-
+#endif
 
 /* Password based encryption structure */
 
@@ -737,11 +738,14 @@ void NETSCAPE_SPKAC_free(NETSCAPE_SPKAC *a);
 NETSCAPE_SPKAC *d2i_NETSCAPE_SPKAC(NETSCAPE_SPKAC **a, const unsigned char **in, long len);
 int i2d_NETSCAPE_SPKAC(NETSCAPE_SPKAC *a, unsigned char **out);
 extern const ASN1_ITEM NETSCAPE_SPKAC_it;
+
+#if !defined(LIBRESSL_NEXT_API) || defined(LIBRESSL_INTERNAL)
 NETSCAPE_CERT_SEQUENCE *NETSCAPE_CERT_SEQUENCE_new(void);
 void NETSCAPE_CERT_SEQUENCE_free(NETSCAPE_CERT_SEQUENCE *a);
 NETSCAPE_CERT_SEQUENCE *d2i_NETSCAPE_CERT_SEQUENCE(NETSCAPE_CERT_SEQUENCE **a, const unsigned char **in, long len);
 int i2d_NETSCAPE_CERT_SEQUENCE(NETSCAPE_CERT_SEQUENCE *a, unsigned char **out);
 extern const ASN1_ITEM NETSCAPE_CERT_SEQUENCE_it;
+#endif
 
 #ifndef OPENSSL_NO_EVP
 X509_INFO *	X509_INFO_new(void);
-- 
2.20.1